dependency-audit

Run a security audit to detect known vulnerabilities and outdated packages across npm, pip, poetry, and other ecosystems. The audit analyzes security risks using native tools, identifies outdated packages with versioning context, and provides upgrade paths with risk assessments.

Yes, you can check license compliance and detect unused dependencies in your project. The audit checks licenses against compliance categories to flag copyleft or missing licenses, and scans code to identify unused imports for removal.

The best way to analyze bundle size impact for JavaScript and TypeScript projects is to estimate the effect of dependencies on the bundle. The audit identifies heavy packages and suggests lighter alternatives to reduce project bloat.

Dependency vulnerability scanning works with Go, Rust, Ruby, and Java/Kotlin ecosystems, alongside npm, yarn, pnpm, and pip. It detects critical, high, medium, and low security risks using native audit tools for each environment.

You should run a full dependency audit before deploying your application to ensure there are no critical vulnerabilities and that all licenses are compliant with your company's policy. This mitigates security risks and reduces bloat.

Major version risk assessment flags potential breaking changes when upgrading outdated packages. It identifies outdated packages with versioning context, evaluates the security and stability risks of major version jumps, and provides safe upgrade paths.